Alberta Reliability Standard Cyber Security Physical Security of BES Cyber Systems CIP-006-AB-5

Transcription

1 Alberta Reliability Stard Final Proposed Draft Version 2.0 September 9, 2014 A. Introduction 1. Title: 2. Number: 3. Purpose: To manage physical access to BES cyber systems by specifying a physical security plan in support of protecting BES cyber systems against compromise that could lead to misoperation or instability in the bulk electric system. 4. Applicability: 4.1. For the purpose of the requirements contained herein, the following list of entities will be collectively referred to as Responsible Entities. For requirements in this stard where a specific entity or subset of entities are the applicable entity or entities, the entity or entities are specified explicitly [Intentionally left blank.] a legal owner of an electric distribution system that owns one or more of the following facilities, systems, equipment for the protection or restoration of the bulk electric system: each underfrequency load shedding or under voltage load shed system that: is part of a load shedding program that is subject to one or more requirements in a reliability stard; performs automatic load shedding under a common control system owned by the entity in subsection , without human operator initiation, of 300 MW or more; each remedial action scheme where the remedial action scheme is subject to one or more requirements in a reliability stard; each protection system (excluding underfrequency load shedding under voltage load shed) that applies to transmission where the protection system is subject to one or more requirements in a reliability stard; each cranking path group of elements meeting the initial switching requirements from a blackstart resource up to including the first point of supply /or point of delivery of the next generating unit or aggregated generating facility to be started; the operator of a generating unit the operator of an aggregated generating facility; the legal owner of a generating unit the legal owner of an aggregated generating facility; Page 1 of 10

2 Alberta Reliability Stard [Intentionally left blank.] [Intentionally left blank.] the operator of a transmission facility; the legal owner of a transmission facility; the ISO For the purpose of the requirements contained herein, the following facilities, systems, equipment owned by each Responsible Entity in subsection 4.1 above are those to which these requirements are applicable. For requirements in this stard where a specific type of facilities, system, or equipment or subset of facilities, systems, equipment are applicable, these are specified explicitly One or more of the following facilities, systems equipment owned by a legal owner of an electric distribution system or a legal owner of a transmission facility for the protection or restoration of the bulk electric system: each underfrequency load shedding or under voltage load shed system that: is part of a load shedding program that is subject to one or more requirements in a reliability stard; performs automatic load shedding under a common control system owned by one or more of the entities in subsection 4.2.1, without human operator initiation, of 300 MW or more; each remedial action scheme where the remedial action scheme is subject to one or more requirements in a reliability stard; each protection system (excluding underfrequency load shedding under voltage load shed) that applies to transmission where the protection system is subject to one or more requirements in a reliability stard; each cranking path group of elements meeting the initial switching requirements from a blackstart resource up to including the first point of supply /or point of delivery of the next generating unit or aggregated generating facility to be started; Responsible Entities listed in subsection 4.1 other than a legal owner of an electric distribution system are responsible for: each transmission facility that is part of the bulk electric system except each transmission facility that: is a transformer with fewer than 2 windings at 100 kv or higher; radially connects only to load; radially connects only to one or more generating units or aggregated generating facilities with a combined maximum authorized real power of less than or equal to 67.5 MW; or radially connects to load one or more generating units or aggregated Page 2 of 10

3 Alberta Reliability Stard generating facilities that have a combined maximum authorized real power of less than or equal to 67.5 MW; does not connect a blackstart resource; a reactive power resource that is dedicated to supplying or absorbing reactive power that is connected at 100 kv or higher, or through a dedicated transformer with a high-side voltage of 100 kv or higher, except those reactive power resources operated by an end-use customer for its own use; a generating unit that is: directly connected to the bulk electric system has a maximum authorized real power rating greater than 18 MW unless the generating unit is part of an industrial complex; within a power plant which: is not part of an aggregated generating facility; is directly connected to the bulk electric system; has a combined maximum authorized real power rating greater than 67.5 MW unless the power plant is part of an industrial complex; within an industrial complex with supply transmission service greater than 67.5 MW; or a blackstart resource; an aggregated generating facility that is: directly connected to the bulk electric system has a maximum authorized real power rating greater than 67.5 MW unless the aggregated generating facility is part of an industrial complex; within an industrial complex with supply transmission service greater than 67.5 MW; or a blackstart resource; control centres backup control centres The following are exempt from reliability stard : [Intentionally left blank.] cyber assets associated with communication networks data communication links between discrete electronic security perimeters [Intentionally left blank.] for the legal owner of an electric distribution system, the systems equipment that are not included in subsection above Responsible Entities that identify that they have no BES cyber systems categorized as High Impact or Medium Impact according to the CIP 002-AB 5.1 identification Page 3 of 10

4 Alberta Reliability Stard 5. [Intentionally left blank.] 6. [Intentionally left blank.] categorization processes. B. Requirements Measures R1. Each Responsible Entity shall implement, in a manner that identifies, assesses, corrects deficiencies, one or more documented physical security plans that collectively include all of the applicable requirement parts in CIP 006-AB 5 Table R1 Physical Security Plan. M1. Evidence must include each of the documented physical security plans that collectively include all of the applicable requirement parts in CIP 006-AB 5 Table R1 Physical Security Plan additional evidence to demonstrate implementation of the plan or plans as described in the Measures column of the table. Table R1 Physical Security Plan 1.1 systems without external routable connectivity Physical access control systems associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity 1.2 routable connectivity Define operational or procedural controls to restrict physical access. Utilize at least one physical access control to allow unescorted physical access into each applicable physical security perimeter to only those individuals who have authorized unescorted physical access. documentation that operational or procedural controls exist. language in the physical security plan that describes each physical security perimeter how unescorted physical access is controlled by one or more different methods proof that unescorted physical access is restricted to only authorized individuals, such as a list of authorized individuals accompanied by access logs. Page 4 of 10

5 Alberta Reliability Stard Table R1 Physical Security Plan 1.3 High Impact BES cyber systems 1.4 High Impact BES cyber systems routable connectivity 1.5 High Impact BES cyber systems routable connectivity Where technically feasible, utilize two or more different physical access controls (this does not require two completely independent physical access control systems) to collectively allow unescorted physical access into physical security perimeters to only those individuals who have authorized unescorted physical access. Monitor for unauthorized access through a physical access point into a physical security perimeter. Issue an alarm or alert in response to detected unauthorized access through a physical access point into a physical security perimeter to the personnel identified in the bulk electric system cyber security incident response plan within 15 minutes of detection. language in the physical security plan that describes the physical security perimeters how unescorted physical access is controlled by two or more different methods proof that unescorted physical access is restricted to only authorized individuals, such as a list of authorized individuals accompanied by access logs. documentation of controls that monitor for unauthorized access through a physical access point into a physical security perimeter. language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized access through a physical access control into a physical security perimeter additional evidence that the alarm or alert was issued communicated as Page 5 of 10

6 Alberta Reliability Stard Table R1 Physical Security Plan 1.6 Physical access control systems associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity 1.7 Physical access control systems associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity 1.8 High Impact BES cyber systems Monitor each physical access control system for unauthorized physical access to a physical access control system. Issue an alarm or alert in response to detected unauthorized physical access to a physical access control system to the personnel identified in the bulk electric system cyber security incident response plan within 15 minutes of the detection. Log (through automated means or by personnel who control entry) entry of each individual with authorized unescorted physical access identified in the bulk electric system cyber security incident response plan, such as manual or electronic alarm or alert logs, cell phone or pager logs, or other evidence that documents that the alarm or alert was generated communicated. documentation of controls that monitor for unauthorized physical access to a physical access control system. language in the physical security plan that describes the issuance of an alarm or alert in response to unauthorized physical access to physical access control systems additional evidence that the alarm or alerts was issued communicated as identified in the bulk electric system cyber security incident response plan, such as alarm or alert logs, cell phone or pager logs, or other evidence that the alarm or alert was generated communicated. language in the physical security plan that describes logging recording of Page 6 of 10

7 Alberta Reliability Stard Table R1 Physical Security Plan into each physical security perimeter, with information to identify the individual date time of entry. routable connectivity 1.9 High Impact BES cyber systems routable connectivity Retain physical access logs of entry of individuals with authorized unescorted physical access into each physical security perimeter for at least ninety days. physical entry into each physical security perimeter additional evidence to demonstrate that this logging has been implemented, such as logs of physical access into physical security perimeters that show the individual the date time of entry into physical security perimeter. dated documentation such as logs of physical access into physical security perimeters that show the date time of entry into physical security perimeter. R2. Each Responsible Entity shall implement, in a manner that identifies, assesses, corrects deficiencies, one or more documented visitor control programs that include each of the applicable requirement parts in CIP 006-AB 5 Table R2 Visitor Control Program. M2. Evidence must include one or more documented visitor control programs that collectively include each of the applicable requirement parts in CIP 006-AB 5 Table R2 Visitor Control Program additional evidence to demonstrate implementation as described in the Measures column of the table. Table R2 Visitor Control Program 2.1 High Impact BES cyber systems Require continuous escorted access of visitors (individuals Page 7 of 10

8 Alberta Reliability Stard Table R2 Visitor Control Program who are provided access but are not authorized for unescorted physical access) within each physical security perimeter, except during CIP exceptional circumstances. routable connectivity 2.2 High Impact BES cyber systems routable connectivity 2.3 High Impact BES cyber systems routable connectivity Require manual or automated logging of visitor entry into exit from the physical security perimeter that includes date time of the initial entry last exit, the visitor s name, the name of an individual point of contact responsible for the visitor, except during CIP exceptional circumstances. Retain visitor logs for at least ninety days. language in a visitor control program that requires continuous escorted access of visitors within physical security perimeters additional evidence to demonstrate that the process was implemented, such as visitor logs. language in a visitor control program that requires continuous escorted access of visitors within physical security perimeters additional evidence to demonstrate that the process was implemented, such as dated visitor logs that include the required information. documentation showing logs have been retained for at least ninety days. Page 8 of 10

9 Alberta Reliability Stard Table R2 Visitor Control Program R3. Each Responsible Entity shall implement one or more documented physical access control system maintenance testing programs that collectively include each of the applicable requirement parts in CIP 006-AB 5 Table R3 Maintenance Testing Program. M3. Evidence must include each of the documented physical access control system maintenance testing programs that collectively include each of the applicable requirement parts in CIP 006-AB 5 Table R3 Maintenance Testing Program additional evidence to demonstrate implementation as described in the Measures column of the table. Table R3 Maintenance Testing Program 3.1 Physical access control systems associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity Locally mounted hardware or devices at the physical security perimeter associated with: High Impact BES cyber systems, or Medium Impact BES cyber systems with external routable connectivity Revision History Maintenance testing of each physical access control system locally mounted hardware or devices at the physical security perimeter at least once every 24 months to ensure they function properly. a maintenance testing program that provides for testing each physical access control system locally mounted hardware or devices associated with each applicable physical security perimeter at least once every 24 months additional evidence to demonstrate that this testing was done, such as dated maintenance records, or other documentation showing testing maintenance has been performed on each applicable device or system at least once every 24 months. Effective Date Description Page 9 of 10

10 Alberta Reliability Stard The first day of the calendar quarter (January 1, April 1, July 1 or October 1) that follows eight (8) full calendar quarters after approval by the Commission. New Issue Page 10 of 10